Pharma & Medical Device ERP: Part 11, Quarantine, DSCSA

FDA 21 CFR Part 11 requires an electronic signature to bind four things: who signed, when, what the signature means, and the exact version of the record signed. A signature that cannot demonstrate all four is an audit finding, not an approval.

What a compliant signature carries

codeunit 50250 "FDA Part 11 E-Signature Engine"
{
    Access = Public;
    Subtype = Normal;

    procedure ValidateQualityRelease(BatchNo: Code[20]; InspectorUserID: Code[50]; PasswordHash: Text): Boolean
    var
        UserSetup: Record "User Setup";
        BatchQualityRecord: Record "Lot Quality Inspection";
    begin
        // 1. Enforce FDA 21 CFR Part 11 Dual Authentication
        if not UserSetup.Get(InspectorUserID) then
            Error('FDA Audit Error: User %1 is not authorized as a Quality Inspector.', InspectorUserID);

        if not UserSetup."Is Quality Inspector Authorized" then
            Error('FDA Audit Error: Inspector %1 lacks FDA Sign-off Security Role.', InspectorUserID);

        // 2. Lock Batch & Update Status
        if BatchQualityRecord.Get(BatchNo) then begin
            BatchQualityRecord."Inspection Status" := BatchQualityRecord."Inspection Status"::Approved;
            BatchQualityRecord."Approved By Inspector" := InspectorUserID;
            BatchQualityRecord."E-Signature Timestamp" := CurrentDateTime;
            BatchQualityRecord.Modify(true);

            LogFDAAuditTrail(BatchNo, InspectorUserID, 'BATCH_APPROVED_FOR_RELEASE');
            exit(true);
        end;

        exit(false);
    end;

    local procedure LogFDAAuditTrail(BatchNo: Code[20]; UserID: Code[50]; ActionText: Text)
    var
        FDAAuditLog: Record "FDA Audit Log";
    begin
        FDAAuditLog.Init();
        FDAAuditLog."Log GUID" := CreateGuid();
        FDAAuditLog."Batch No." := BatchNo;
        FDAAuditLog."User ID" := UserID;
        FDAAuditLog."Action Description" := ActionText;
        FDAAuditLog."Timestamp" := CurrentDateTime;
        FDAAuditLog.Insert(true);
    end;
}

1. Identity, re-authenticated at the moment of signing and not inherited from the session.
2. Timestamp, from a controlled source, not the client machine.
3. Meaning — reviewed, approved, rejected — recorded explicitly.
4. The record version, so a later change cannot be presented as having been signed.

The fourth is the one implementations miss. If the signed record can be edited afterwards without invalidating the signature, the signature proves nothing about what was approved.

Quarantine as an enforced state

Received material is quarantined until quality releases it. The distinction that matters is whether that state blocks a pick or merely describes one.

Certificates of analysis

A batch is releasable when its testing passes. That means the CoA has to live on the batch record — linked, version-controlled, and a precondition of the release transaction rather than a document somebody files afterwards.

In a recall, the question is not whether you tested the batch. It is whether you can produce, within hours, the test result that was in force when that batch was released, and the signature of the person who released it.

Serialisation and track-and-trace

DSCSA requires unit-level traceability through the supply chain. In practice the ERP must receive serialised data, verify it against what was expected, retain it, and transmit it onward in the required format.

Partial implementation does not partially comply. A chain with one participant who cannot pass data through is a chain that is broken at that participant, which is why this is a trading-relationship requirement as much as a technical one.

Validation and change control

A GxP system is validated for a specific configuration. Changing it — including applying a platform update — requires qualification of the change before it is used in production.

This is the reason regulated implementations move at a different pace, and the reason an automated test suite pays for itself faster here than anywhere else: the evidence a validation package needs is exactly what a test run already produces.